topic Re: HTTP ACCESS enbled by implied rule in General Topics

HTTP ACCESS enbled by implied rule

Stefano_Chiesa — Mon, 17 Feb 2020 13:47:37 GMT

Hello all.

I noticed that HTTP access to each of nodes in a cluster is enabled by implied rules.

Is there a way to disable it? Maybe locally because the customer have 5 clusters under the same Management and I would like to avoid global changes...

Below the enabled blades and the log row.

Thanks in advance.
Regards.

Stefano.

Re: HTTP ACCESS enbled by implied rule

G_W_Albrecht — Mon, 17 Feb 2020 13:51:47 GMT

sk115600: How to view Implied Rules in R80.x SmartConsole

sk43401: How to completely disable FireWall Implied Rules

Re: HTTP ACCESS enbled by implied rule

_Val_ — Mon, 17 Feb 2020 14:03:16 GMT

Yes, GWs are allowed to open outgoing connections via implied rules. This is usually required for normal functions. If you change that, some features: AVI & IPS updates, URL and AC categorization and others, may not work.

Why are you concerned with this in the first place?

Re: HTTP ACCESS enbled by implied rule

Stefano_Chiesa — Mon, 17 Feb 2020 14:49:20 GMT

Hi Val_Loukine, thanks for your answer.
A vulnerability scan found the HTTP port open and has it been marked as weakness, the customer asked to close it....

Re: HTTP ACCESS enbled by implied rule

_Val_ — Mon, 17 Feb 2020 14:57:38 GMT

So it is not gateway originated connection, the other way around.

Firstly, having http port open does not mean vulnerability.

GW may have one or more portals: WebUI, Mobile Access, Identity Awareness, etc. Those are also needed for functioning correctly. If you are concerned with WebUI being accessed from outside of protected perimeter, you can change the port and interfaces it is available through on GW object, Portals tab

Re: HTTP ACCESS enbled by implied rule

Stefano_Chiesa — Wed, 19 Feb 2020 07:09:34 GMT

Thanks, I'll check the active (and needed) modules.

Regards.